OS Command Injection in DrayTek Vigor Routers (CVE‑2024‑12987) Threatens Network Management Interfaces
What It Is — DrayTek Vigor 2960, Vigor 300B, and Vigor 3900 routers expose a server‑side OS command injection flaw in the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint of the web management console.
Exploitability — The vulnerability is publicly disclosed (CVE‑2024‑12987) and assigned a CVSS v3.1 base score of 8.8 (High). No public exploit code has been released, but the vulnerable endpoint is reachable over the management interface, making remote exploitation feasible for attackers with network access.
Affected Products – DrayTek Vigor 2960, Vigor 300B, Vigor 3900 routers (all firmware versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Configuration control – The flaw highlights the need for continuous verification that network device configurations remain hardened and that only authorized management interfaces are exposed.
- Audit evidence – Demonstrating that vulnerable firmware has been remediated provides defensible proof for auditors assessing secure configuration management.
- Supply‑chain diligence – Organizations that rely on third‑party routers must incorporate firmware‑patch status into their vendor‑risk monitoring to maintain a trustworthy security posture.
Recommended Actions
- Inventory all DrayTek Vigor devices and verify firmware versions against the vendor’s advisory.
- Apply the latest security patch released by DrayTek or, if patching is not possible, isolate the management interface behind a hardened firewall and enforce strong authentication.
- Capture remediation evidence (patch version, configuration snapshots) and map the activity to the “Secure Configuration Management” control objective in your chosen framework.
Source: CISA KEV – CVE‑2024‑12987